Freetype vulnerability / CVE-2022-27405, CVE-2022-27406

arunsai271 commented 2 years ago

In alpine 3.15.4 version image, the max supported freetype version is 2.11, but in order to resolve the CVE-2022-27405, CVE-2022-27406 issues the alpine 3.15.4 version should support Freetype 2.12 version. We can see here at https://gitlab.alpinelinux.org/alpine/aports/-/issues/13777 that the same request to upgradation is taken care and changes are merged into master branch. kindly can you please let us know when these changes will be available as patch fix in 3.15.4 version docker image ?

mitchellmaler commented 2 years ago

Currently, freetype 2.12.1 is in the edge main repo. You can upgrade it by running this command apk upgrade freetype --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main

arunsai271 commented 2 years ago

@mitchellmaler Tried with the suggested command, but still it is pulling 2.11 version. Please help

Note: I cannot upgrade my alpine OS to Edge in Production, since we know Edge is like Beta version and not supposed to use in production.

OS Details:

/ # cat /etc/os-release NAME="Alpine Linux" ID=alpine VERSION_ID=3.15.4 PRETTY_NAME="Alpine Linux v3.15" HOME_URL="https://alpinelinux.org/" BUG_REPORT_URL="https://bugs.alpinelinux.org/" / #

upgradation:

/ # apk upgrade freetype --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main fetch http://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz fetch https://dl-cdn.alpinelinux.org/alpine/v3.15/main/x86_64/APKINDEX.tar.gz fetch https://dl-cdn.alpinelinux.org/alpine/v3.15/community/x86_64/APKINDEX.tar.gz OK: 6 MiB in 14 packages

Details after upgrading:

/ # apk search | grep freetype freetype-2.11.1-r1 freetype-dev-2.11.1-r1 freetype-doc-2.11.1-r1 freetype-static-2.11.1-r1 / #

mitchellmaler commented 2 years ago

You most likely need to remove the old freetype version first apk del freetype && apk add --upgrade freetype --repository=http://dl-cdn.alpinelinux.org/alpine/edge/main

arunsai271 commented 2 years ago

@mitchellmaler Thank you, the command is working. But in the same way i tried to upgrade openjdk8-jre which internally use freetype. openjdk8-jre 8.302 uses freetype 2.11 so I want to upgrade to openjdk-jre 8.312 which use internally freetype 2.12. But in this case still openjdk-jre 8.312 is pulling freetype 2.11 version but i want it to pull freetype 2.12 version. Can you please suggest how to achieve it? Because still my vulnerability scanner tool is picking freetype 2,11 issue.

/ # apk update fetch https://dl-cdn.alpinelinux.org/alpine/v3.15/main/x86_64/APKINDEX.tar.gz fetch https://dl-cdn.alpinelinux.org/alpine/v3.15/community/x86_64/APKINDEX.tar.gz v3.15.4-124-ga85ef407d0 [https://dl-cdn.alpinelinux.org/alpine/v3.15/main] v3.15.4-128-gcc1b3f7211 [https://dl-cdn.alpinelinux.org/alpine/v3.15/community] OK: 15857 distinct packages available

/ # apk del openjdk8-jre && apk add --upgrade openjdk8-jre --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community OK: 6 MiB in 14 packages fetch http://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz Installing openjdk8-jre (8.312.07-r0) Executing busybox-1.34.1-r5.trigger Executing fontconfig-2.13.1-r4.trigger Executing mkfontscale-1.2.1-r1.trigger Executing java-common-0.5-r0.trigger Executing ca-certificates-20211220-r0.trigger OK: 106 MiB in 62 packages

/ # apk search | grep freetype freetype-2.11.1-r1 freetype-dev-2.11.1-r1 freetype-doc-2.11.1-r1 freetype-static-2.11.1-r1 / #

arunsai271 commented 2 years ago

@mitchellmaler any update please on how to resolve?

Loqova commented 2 years ago

It seems to me that nginx:mainline-alpine currently Alpine Linux v3.15.4, is according to a Grype-scan still vulnerable to:

NAME      INSTALLED  FIXED-IN   TYPE  VULNERABILITY   SEVERITY
curl      7.80.0-r0  7.80.0-r1  apk   CVE-2022-22576  Unknown
curl      7.80.0-r0  7.80.0-r1  apk   CVE-2022-27775  Unknown
curl      7.80.0-r0  7.80.0-r1  apk   CVE-2022-27776  Unknown
curl      7.80.0-r0  7.80.0-r1  apk   CVE-2022-27774  Unknown
freetype  2.11.1-r0             apk   CVE-2022-27405  High
freetype  2.11.1-r0  2.11.1-r1  apk   CVE-2022-27404  Critical
freetype  2.11.1-r0             apk   CVE-2022-27406  High
libcurl   7.80.0-r0  7.80.0-r1  apk   CVE-2022-22576  Unknown
libcurl   7.80.0-r0  7.80.0-r1  apk   CVE-2022-27774  Unknown
libcurl   7.80.0-r0  7.80.0-r1  apk   CVE-2022-27775  Unknown
libcurl   7.80.0-r0  7.80.0-r1  apk   CVE-2022-27776  Unknown
libgd     2.3.2-r1              apk   CVE-2021-38115  Medium
libgd     2.3.2-r1              apk   CVE-2021-40812  Medium
libgd     2.3.2-r1              apk   CVE-2021-40145  High
libxml2   2.9.13-r0  2.9.14-r0  apk   CVE-2022-29824  Medium
xz-libs   5.2.5-r0   5.2.5-r1   apk   CVE-2022-1271   Unknown

arunsai271 commented 2 years ago

Hi @mitchellmaler /Team, any updates on the solution, please? sorry to bother but since it is a security-related concern, it is a priority for us. If we get a new alpine 3.15.5 version Image with all these fixes, it would solve all our problems with hassle-free.

atawfik-elsevier commented 2 years ago

Hi @mitchellmaler we're also having issues concerning this. Is there a plan to release a new version without the freetype vulnerability, or is docker-alpine no longer in support? Thanks!

Khazii commented 2 years ago

Hi all, we're also getting the same issue:

Total: 1 (CRITICAL: 1)

+----------+------------------+----------+-------------------+---------------+---------------------------------------+
| LIBRARY  | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+----------+------------------+----------+-------------------+---------------+---------------------------------------+
| freetype | CVE-2022-27404   | CRITICAL | 2.11.1-r0         | 2.11.1-r1     | FreeType: Buffer Overflow             |
|          |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-27404 |
+----------+------------------+----------+-------------------+---------------+---------------------------------------+

Which is also blocking us from deploying.

ncopa commented 2 years ago

This is technically wrong place to report issues with freetype since alpine docker base image does not include freetype. https://gitlab.alpinelinux.org/alpine/aports/-/issues would be better.

That said, I backported fixes for CVE-2022-27405, CVE-2022-27406 in freetype-2.11.1-r2. see alpinelinux/aports@2cac7499017def246acff43ed3bec6e9e857c240

ncopa commented 2 years ago

Hi all, we're also getting the same issue:

Total: 1 (CRITICAL: 1)

+----------+------------------+----------+-------------------+---------------+---------------------------------------+
| LIBRARY  | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+----------+------------------+----------+-------------------+---------------+---------------------------------------+
| freetype | CVE-2022-27404   | CRITICAL | 2.11.1-r0         | 2.11.1-r1     | FreeType: Buffer Overflow             |
|          |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-27404 |
+----------+------------------+----------+-------------------+---------------+---------------------------------------+

Which is also blocking us from deploying.

The docker image that pulls in freetype needs to be rebuilt. I don't know which image that is in your case, but I know for sure its not the alpine base image.

ncopa commented 2 years ago

If we get a new alpine 3.15.5 version Image with all these fixes, it would solve all our problems with hassle-free.

alpine base image does not include freetype so it would not really solve anything. I cannot bump version number of the base package every time any package in any repository gets a security update. I do create new release when the bas image itself has vulnerable packages (openssl, apk-tools, zlib, busybox).

arunsai271 commented 2 years ago

@ncopa Thank you for updating, I will move to Debian OS images.

roshan989 commented 2 years ago

@ncopa Thanks for your mention. I checked, in my case it is comping from openjdk11 with almost 6 lib that is vulnerable and not fixed by updating jdk or upgrading java version. please correct me for any mistake and suggest any other OS image that will not download vul lib with openjdk11.

ncopa commented 2 years ago

@ncopa Thanks for your mention. I checked, in my case it is comping from openjdk11 with almost 6 lib that is vulnerable and not fixed by updating jdk or upgrading java version. please correct me for any mistake and suggest any other OS image that will not download vul lib with openjdk11.

Do you have the list of CVEs and/or packages that are vulnerable?

atawfik-elsevier commented 2 years ago

Security checks for new builds are passing now, thanks!

roshan989 commented 2 years ago

@ncopa RUN apk update && \ apk add openjdk11 && \ apk add --no-cache bash && \ apk add curl

RUN apk add --update oniguruma && \ apk add --update libx11

RUN apk add --update curl && rm -rf /var/cache/apk/* RUN apk add jq

freetype giflib ncurses-libs ncurses-terminfo-base lcms2

alpinelinux / docker-alpine

Freetype vulnerability / CVE-2022-27405, CVE-2022-27406 #253